In the Alerts's fly-out details panel is the description of the IOC report being invoked:
Name Powershell Setting Registry Run Key | Persistence | T1547 Description Detects a registry "Run" key mentioned in a fileless scriptload, which could be indicative of an attempt to create persistence. Check the value of the key to determine which program will run upon system startup. IOC hit (fileless_scriptload_cmdline:New-ItemProperty AND (fileless_scriptload_cmdline:SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run OR fileless_scriptload_cmdline:SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce) NOT fileless_scriptload_cmdline:autodesk)What this means the IOC in the report doesn't look for a regmod but rather looks for the "runonce" key in the
fileless_scriptload_cmdline
.